Cong Wang 91cff53136 bpf: Fix a potential use-after-free in bpf_link_free() ...

[ Upstream commit 2884dc7d08 ]

After commit 1a80dbcb2d, bpf_link can be freed by
link->ops->dealloc_deferred, but the code still tests and uses
link->ops->dealloc afterward, which leads to a use-after-free as
reported by syzbot. Actually, one of them should be sufficient, so
just call one of them instead of both. Also add a WARN_ON() in case
of any problematic implementation.

Fixes: 1a80dbcb2d ("bpf: support deferring bpf_link dealloc to after RCU grace period")
Reported-by: syzbot+1989ee16d94720836244@syzkaller.appspotmail.com
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/20240602182703.207276-1-xiyou.wangcong@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-06-21 14:38:15 +02:00

..

preload

bpf: make preloaded map iterators to display map elements count

2023-07-06 12:42:25 -07:00

arraymap.c

bpf: Set need_defer as false when clearing fd array during map free

2024-02-05 20:14:20 +00:00

bloom_filter.c

bpf: Check bloom filter map value size

2024-05-17 12:02:11 +02:00

bpf_cgrp_storage.c

bpf: Teach verifier that certain helpers accept NULL pointer.

2023-04-04 16:57:16 -07:00

bpf_inode_storage.c

Merge tag 'net-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

2023-04-26 16:07:23 -07:00

bpf_iter.c

…

bpf_local_storage.c

bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc

2023-09-06 11:08:14 +02:00

bpf_lru_list.c

bpf: Address KCSAN report on bpf_lru_list

2023-05-12 12:01:03 -07:00

bpf_lru_list.h

bpf: lru: Remove unused declaration bpf_lru_promote()

2023-08-08 17:21:42 -07:00

bpf_lsm.c

…

bpf_struct_ops_types.h

…

bpf_struct_ops.c

bpf: Support default .validate() and .update() behavior for struct_ops links

2023-08-14 22:23:39 -07:00

bpf_task_storage.c

bpf: Teach verifier that certain helpers accept NULL pointer.

2023-04-04 16:57:16 -07:00

btf.c

bpf: Add bpf_sock_addr_set_sun_path() to allow writing unix sockaddr from bpf

2024-01-31 16:19:04 -08:00

cgroup_iter.c

cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers

2023-03-17 12:07:13 -10:00

cgroup.c

bpf: Propagate modified uaddrlen from cgroup sockaddr programs

2024-01-31 16:19:04 -08:00

core.c

bpf: Optimize the free of inner map

2024-06-21 14:38:15 +02:00

cpumap.c

bpf: report RCU QS in cpumap kthread

2024-03-26 18:20:12 -04:00

cpumask.c

bpf: Convert bpf_cpumask to bpf_mem_cache_free_rcu.

2023-07-12 23:45:23 +02:00

devmap.c

bpf: Fix DEVMAP_HASH overflow check on 32-bit arches

2024-03-26 18:19:39 -04:00

disasm.c

bpf: change bpf_alu_sign_string and bpf_movsx_string to static

2023-08-04 16:15:50 -07:00

disasm.h

…

dispatcher.c

…

hashtab.c

bpf: Fix hashtab overflow check on 32-bit arches

2024-03-26 18:19:39 -04:00

helpers.c

bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly

2024-03-26 18:19:29 -04:00

inode.c

bpf: convert to ctime accessor functions

2023-07-24 10:30:07 +02:00

Kconfig

bpf: Add fd-based tcx multi-prog infra with link support

2023-07-19 10:07:27 -07:00

link_iter.c

…

local_storage.c

Merge tag 'cgroup-for-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

2023-04-29 10:05:22 -07:00

log.c

bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log

2023-05-16 22:34:50 -07:00

lpm_trie.c

bpf, lpm: Fix check prefixlen before walking trie

2024-01-25 15:35:19 -08:00

Makefile

bpf: Add fd-based tcx multi-prog infra with link support

2023-07-19 10:07:27 -07:00

map_in_map.c

bpf: Optimize the free of inner map

2024-06-21 14:38:15 +02:00

map_in_map.h

bpf: Add map and need_defer parameters to .map_fd_put_ptr()

2024-01-25 15:35:22 -08:00

map_iter.c

bpf: allow any program to use the bpf_map_sum_elem_count kfunc

2023-07-19 09:48:53 -07:00

memalloc.c

bpf: Use c->unit_size to select target cache during free

2024-01-25 15:35:28 -08:00

mmap_unlock_work.h

…

mprog.c

bpf: Handle bpf_mprog_query with NULL entry

2023-10-06 17:11:20 -07:00

net_namespace.c

…

offload.c

bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init

2023-09-11 22:06:06 -07:00

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

bpf: Avoid deadlock when using queue and stack maps from NMI

2023-09-11 19:04:49 -07:00

reuseport_array.c

bpf: Centralize permissions checks for all BPF map types

2023-06-19 14:04:04 +02:00

ringbuf.c

bpf: Remove unnecessary ring buffer size check

2023-07-05 14:09:45 +02:00

stackmap.c

bpf: Fix stackmap overflow check on 32-bit arches

2024-03-26 18:19:39 -04:00

syscall.c

bpf: Fix a potential use-after-free in bpf_link_free()

2024-06-21 14:38:15 +02:00

sysfs_btf.c

…

task_iter.c

…

tcx.c

bpf: Handle bpf_mprog_query with NULL entry

2023-10-06 17:11:20 -07:00

tnum.c

…

trampoline.c

bpf, x64: Fix tailcall infinite loop

2023-11-20 11:58:55 +01:00

verifier.c

bpf: Optimize the free of inner map

2024-06-21 14:38:15 +02:00